CVE-2015-0921 | BDVDB-2026-67227 Detail
Description#
XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://secunia.com/advisories/61922
- http://seclists.org/fulldisclosure/2015/Jan/37
- https://kc.mcafee.com/corporate/index?page=content&id=SB10095
- http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html
- http://seclists.org/fulldisclosure/2015/Jan/8
- http://www.securitytracker.com/id/1031519
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99950
- https://gist.github.com/brandonprry/692e553975bf29aeaf2c
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.